diff options
| author | Jung-uk Kim <jkim@FreeBSD.org> | 2020-01-02 21:12:47 +0000 |
|---|---|---|
| committer | Jung-uk Kim <jkim@FreeBSD.org> | 2020-01-02 21:12:47 +0000 |
| commit | 059864c9bece90b6b96747a1a56508f308dddebf (patch) | |
| tree | f737c903cef3c08fbe1c24823d2a18cc56b505a8 /apps/s_server.c | |
| parent | 1da9a06f2daf1285fb82196ec2995c9c32a2e51c (diff) | |
Notes
Diffstat (limited to 'apps/s_server.c')
| -rw-r--r-- | apps/s_server.c | 16 |
1 files changed, 11 insertions, 5 deletions
diff --git a/apps/s_server.c b/apps/s_server.c index ce7a1d64b6391..a122b3907048b 100644 --- a/apps/s_server.c +++ b/apps/s_server.c @@ -56,7 +56,7 @@ * [including the GNU Public Licence.] */ /* ==================================================================== - * Copyright (c) 1998-2018 The OpenSSL Project. All rights reserved. + * Copyright (c) 1998-2019 The OpenSSL Project. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions @@ -3045,6 +3045,12 @@ static int www_body(int s, int stype, unsigned char *context) if (e[0] == ' ') break; + if (e[0] == ':') { + /* Windows drive. We treat this the same way as ".." */ + dot = -1; + break; + } + switch (dot) { case 1: dot = (e[0] == '.') ? 2 : 0; @@ -3053,11 +3059,11 @@ static int www_body(int s, int stype, unsigned char *context) dot = (e[0] == '.') ? 3 : 0; break; case 3: - dot = (e[0] == '/') ? -1 : 0; + dot = (e[0] == '/' || e[0] == '\\') ? -1 : 0; break; } if (dot == 0) - dot = (e[0] == '/') ? 1 : 0; + dot = (e[0] == '/' || e[0] == '\\') ? 1 : 0; } dot = (dot == 3) || (dot == -1); /* filename contains ".." * component */ @@ -3071,11 +3077,11 @@ static int www_body(int s, int stype, unsigned char *context) if (dot) { BIO_puts(io, text); - BIO_printf(io, "'%s' contains '..' reference\r\n", p); + BIO_printf(io, "'%s' contains '..' or ':'\r\n", p); break; } - if (*p == '/') { + if (*p == '/' || *p == '\\') { BIO_puts(io, text); BIO_printf(io, "'%s' is an invalid path\r\n", p); break; |